drivers/usb/gadget/legacy/raw_gadget.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * USB Raw Gadget driver.
   4  * See Documentation/usb/raw-gadget.rst for more details.
   5  *
   6  * Copyright (c) 2020 Google, Inc.
   7  * Author: Andrey Konovalov <andreyknvl@gmail.com>
   8  */
   9
  10 #include <linux/compiler.h>
  11 #include <linux/ctype.h>
  12 #include <linux/debugfs.h>
  13 #include <linux/delay.h>
  14 #include <linux/idr.h>
  15 #include <linux/kref.h>
  16 #include <linux/miscdevice.h>
  17 #include <linux/module.h>
  18 #include <linux/semaphore.h>
  19 #include <linux/sched.h>
  20 #include <linux/slab.h>
  21 #include <linux/uaccess.h>
  22 #include <linux/wait.h>
  23
  24 #include <linux/usb.h>
  25 #include <linux/usb/ch9.h>
  26 #include <linux/usb/ch11.h>
  27 #include <linux/usb/gadget.h>
  28
  29 #include <uapi/linux/usb/raw_gadget.h>
  30
  31 #define DRIVER_DESC "USB Raw Gadget"
  32 #define DRIVER_NAME "raw-gadget"
  33
  34 MODULE_DESCRIPTION(DRIVER_DESC);
  35 MODULE_AUTHOR("Andrey Konovalov");
  36 MODULE_LICENSE("GPL");
  37
  38 /*----------------------------------------------------------------------*/
  39
  40 static DEFINE_IDA(driver_id_numbers);
  41 #define DRIVER_DRIVER_NAME_LENGTH_MAX   32
  42
  43 #define RAW_EVENT_QUEUE_SIZE    16
  44
  45 struct raw_event_queue {
  46         /* See the comment in raw_event_queue_fetch() for locking details. */
  47         spinlock_t              lock;
  48         struct semaphore        sema;
  49         struct usb_raw_event    *events[RAW_EVENT_QUEUE_SIZE];
  50         int                     size;
  51 };
  52
  53 static void raw_event_queue_init(struct raw_event_queue *queue)
  54 {
  55         spin_lock_init(&queue->lock);
  56         sema_init(&queue->sema, 0);
  57         queue->size = 0;
  58 }
  59
  60 static int raw_event_queue_add(struct raw_event_queue *queue,
  61         enum usb_raw_event_type type, size_t length, const void *data)
  62 {
  63         unsigned long flags;
  64         struct usb_raw_event *event;
  65
  66         spin_lock_irqsave(&queue->lock, flags);
  67         if (WARN_ON(queue->size >= RAW_EVENT_QUEUE_SIZE)) {
  68                 spin_unlock_irqrestore(&queue->lock, flags);
  69                 return -ENOMEM;
  70         }
  71         event = kmalloc(sizeof(*event) + length, GFP_ATOMIC);
  72         if (!event) {
  73                 spin_unlock_irqrestore(&queue->lock, flags);
  74                 return -ENOMEM;
  75         }
  76         event->type = type;
  77         event->length = length;
  78         if (event->length)
  79                 memcpy(&event->data[0], data, length);
  80         queue->events[queue->size] = event;
  81         queue->size++;
  82         up(&queue->sema);
  83         spin_unlock_irqrestore(&queue->lock, flags);
  84         return 0;
  85 }
  86
  87 static struct usb_raw_event *raw_event_queue_fetch(
  88                                 struct raw_event_queue *queue)
  89 {
  90         int ret;
  91         unsigned long flags;
  92         struct usb_raw_event *event;
  93
  94         /*
  95          * This function can be called concurrently. We first check that
  96          * there's at least one event queued by decrementing the semaphore,
  97          * and then take the lock to protect queue struct fields.
  98          */
  99         ret = down_interruptible(&queue->sema);
 100         if (ret)
 101                 return ERR_PTR(ret);
 102         spin_lock_irqsave(&queue->lock, flags);
 103         /*
 104          * queue->size must have the same value as queue->sema counter (before
 105          * the down_interruptible() call above), so this check is a fail-safe.
 106          */
 107         if (WARN_ON(!queue->size)) {
 108                 spin_unlock_irqrestore(&queue->lock, flags);
 109                 return ERR_PTR(-ENODEV);
 110         }
 111         event = queue->events[0];
 112         queue->size--;
 113         memmove(&queue->events[0], &queue->events[1],
 114                         queue->size * sizeof(queue->events[0]));
 115         spin_unlock_irqrestore(&queue->lock, flags);
 116         return event;
 117 }
 118
 119 static void raw_event_queue_destroy(struct raw_event_queue *queue)
 120 {
 121         int i;
 122
 123         for (i = 0; i < queue->size; i++)
 124                 kfree(queue->events[i]);
 125         queue->size = 0;
 126 }
 127
 128 /*----------------------------------------------------------------------*/
 129
 130 struct raw_dev;
 131
 132 enum ep_state {
 133         STATE_EP_DISABLED,
 134         STATE_EP_ENABLED,
 135 };
 136
 137 struct raw_ep {
 138         struct raw_dev          *dev;
 139         enum ep_state           state;
 140         struct usb_ep           *ep;
 141         u8                      addr;
 142         struct usb_request      *req;
 143         bool                    urb_queued;
 144         bool                    disabling;
 145         ssize_t                 status;
 146 };
 147
 148 enum dev_state {
 149         STATE_DEV_INVALID = 0,
 150         STATE_DEV_OPENED,
 151         STATE_DEV_INITIALIZED,
 152         STATE_DEV_REGISTERING,
 153         STATE_DEV_RUNNING,
 154         STATE_DEV_CLOSED,
 155         STATE_DEV_FAILED
 156 };
 157
 158 struct raw_dev {
 159         struct kref                     count;
 160         spinlock_t                      lock;
 161
 162         const char                      *udc_name;
 163         struct usb_gadget_driver        driver;
 164
 165         /* Reference to misc device: */
 166         struct device                   *dev;
 167
 168         /* Make driver names unique */
 169         int                             driver_id_number;
 170
 171         /* Protected by lock: */
 172         enum dev_state                  state;
 173         bool                            gadget_registered;
 174         struct usb_gadget               *gadget;
 175         struct usb_request              *req;
 176         bool                            ep0_in_pending;
 177         bool                            ep0_out_pending;
 178         bool                            ep0_urb_queued;
 179         ssize_t                         ep0_status;
 180         struct raw_ep                   eps[USB_RAW_EPS_NUM_MAX];
 181         int                             eps_num;
 182
 183         struct completion               ep0_done;
 184         struct raw_event_queue          queue;
 185 };
 186
 187 static struct raw_dev *dev_new(void)
 188 {
 189         struct raw_dev *dev;
 190
 191         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
 192         if (!dev)
 193                 return NULL;
 194         /* Matches kref_put() in raw_release(). */
 195         kref_init(&dev->count);
 196         spin_lock_init(&dev->lock);
 197         init_completion(&dev->ep0_done);
 198         raw_event_queue_init(&dev->queue);
 199         dev->driver_id_number = -1;
 200         return dev;
 201 }
 202
 203 static void dev_free(struct kref *kref)
 204 {
 205         struct raw_dev *dev = container_of(kref, struct raw_dev, count);
 206         int i;
 207
 208         kfree(dev->udc_name);
 209         kfree(dev->driver.udc_name);
 210         kfree(dev->driver.driver.name);
 211         if (dev->driver_id_number >= 0)
 212                 ida_free(&driver_id_numbers, dev->driver_id_number);
 213         if (dev->req) {
 214                 if (dev->ep0_urb_queued)
 215                         usb_ep_dequeue(dev->gadget->ep0, dev->req);
 216                 usb_ep_free_request(dev->gadget->ep0, dev->req);
 217         }
 218         raw_event_queue_destroy(&dev->queue);
 219         for (i = 0; i < dev->eps_num; i++) {
 220                 if (dev->eps[i].state == STATE_EP_DISABLED)
 221                         continue;
 222                 usb_ep_disable(dev->eps[i].ep);
 223                 usb_ep_free_request(dev->eps[i].ep, dev->eps[i].req);
 224                 kfree(dev->eps[i].ep->desc);
 225                 dev->eps[i].state = STATE_EP_DISABLED;
 226         }
 227         kfree(dev);
 228 }
 229
 230 /*----------------------------------------------------------------------*/
 231
 232 static int raw_queue_event(struct raw_dev *dev,
 233         enum usb_raw_event_type type, size_t length, const void *data)
 234 {
 235         int ret = 0;
 236         unsigned long flags;
 237
 238         ret = raw_event_queue_add(&dev->queue, type, length, data);
 239         if (ret < 0) {
 240                 spin_lock_irqsave(&dev->lock, flags);
 241                 dev->state = STATE_DEV_FAILED;
 242                 spin_unlock_irqrestore(&dev->lock, flags);
 243         }
 244         return ret;
 245 }
 246
 247 static void gadget_ep0_complete(struct usb_ep *ep, struct usb_request *req)
 248 {
 249         struct raw_dev *dev = req->context;
 250         unsigned long flags;
 251
 252         spin_lock_irqsave(&dev->lock, flags);
 253         if (req->status)
 254                 dev->ep0_status = req->status;
 255         else
 256                 dev->ep0_status = req->actual;
 257         if (dev->ep0_in_pending)
 258                 dev->ep0_in_pending = false;
 259         else
 260                 dev->ep0_out_pending = false;
 261         spin_unlock_irqrestore(&dev->lock, flags);
 262
 263         complete(&dev->ep0_done);
 264 }
 265
 266 static u8 get_ep_addr(const char *name)
 267 {
 268         /* If the endpoint has fixed function (named as e.g. "ep12out-bulk"),
 269          * parse the endpoint address from its name. We deliberately use
 270          * deprecated simple_strtoul() function here, as the number isn't
 271          * followed by '\0' nor '\n'.
 272          */
 273         if (isdigit(name[2]))
 274                 return simple_strtoul(&name[2], NULL, 10);
 275         /* Otherwise the endpoint is configurable (named as e.g. "ep-a"). */
 276         return USB_RAW_EP_ADDR_ANY;
 277 }
 278
 279 static int gadget_bind(struct usb_gadget *gadget,
 280                         struct usb_gadget_driver *driver)
 281 {
 282         int ret = 0, i = 0;
 283         struct raw_dev *dev = container_of(driver, struct raw_dev, driver);
 284         struct usb_request *req;
 285         struct usb_ep *ep;
 286         unsigned long flags;
 287
 288         if (strcmp(gadget->name, dev->udc_name) != 0)
 289                 return -ENODEV;
 290
 291         set_gadget_data(gadget, dev);
 292         req = usb_ep_alloc_request(gadget->ep0, GFP_KERNEL);
 293         if (!req) {
 294                 dev_err(&gadget->dev, "usb_ep_alloc_request failed\n");
 295                 set_gadget_data(gadget, NULL);
 296                 return -ENOMEM;
 297         }
 298
 299         spin_lock_irqsave(&dev->lock, flags);
 300         dev->req = req;
 301         dev->req->context = dev;
 302         dev->req->complete = gadget_ep0_complete;
 303         dev->gadget = gadget;
 304         gadget_for_each_ep(ep, dev->gadget) {
 305                 dev->eps[i].ep = ep;
 306                 dev->eps[i].addr = get_ep_addr(ep->name);
 307                 dev->eps[i].state = STATE_EP_DISABLED;
 308                 i++;
 309         }
 310         dev->eps_num = i;
 311         spin_unlock_irqrestore(&dev->lock, flags);
 312
 313         ret = raw_queue_event(dev, USB_RAW_EVENT_CONNECT, 0, NULL);
 314         if (ret < 0) {
 315                 dev_err(&gadget->dev, "failed to queue event\n");
 316                 set_gadget_data(gadget, NULL);
 317                 return ret;
 318         }
 319
 320         /* Matches kref_put() in gadget_unbind(). */
 321         kref_get(&dev->count);
 322         return ret;
 323 }
 324
 325 static void gadget_unbind(struct usb_gadget *gadget)
 326 {
 327         struct raw_dev *dev = get_gadget_data(gadget);
 328
 329         set_gadget_data(gadget, NULL);
 330         /* Matches kref_get() in gadget_bind(). */
 331         kref_put(&dev->count, dev_free);
 332 }
 333
 334 static int gadget_setup(struct usb_gadget *gadget,
 335                         const struct usb_ctrlrequest *ctrl)
 336 {
 337         int ret = 0;
 338         struct raw_dev *dev = get_gadget_data(gadget);
 339         unsigned long flags;
 340
 341         spin_lock_irqsave(&dev->lock, flags);
 342         if (dev->state != STATE_DEV_RUNNING) {
 343                 dev_err(&gadget->dev, "ignoring, device is not running\n");
 344                 ret = -ENODEV;
 345                 goto out_unlock;
 346         }
 347         if (dev->ep0_in_pending || dev->ep0_out_pending) {
 348                 dev_dbg(&gadget->dev, "stalling, request already pending\n");
 349                 ret = -EBUSY;
 350                 goto out_unlock;
 351         }
 352         if ((ctrl->bRequestType & USB_DIR_IN) && ctrl->wLength)
 353                 dev->ep0_in_pending = true;
 354         else
 355                 dev->ep0_out_pending = true;
 356         spin_unlock_irqrestore(&dev->lock, flags);
 357
 358         ret = raw_queue_event(dev, USB_RAW_EVENT_CONTROL, sizeof(*ctrl), ctrl);
 359         if (ret < 0)
 360                 dev_err(&gadget->dev, "failed to queue event\n");
 361         goto out;
 362
 363 out_unlock:
 364         spin_unlock_irqrestore(&dev->lock, flags);
 365 out:
 366         return ret;
 367 }
 368
 369 /* These are currently unused but present in case UDC driver requires them. */
 370 static void gadget_disconnect(struct usb_gadget *gadget) { }
 371 static void gadget_suspend(struct usb_gadget *gadget) { }
 372 static void gadget_resume(struct usb_gadget *gadget) { }
 373 static void gadget_reset(struct usb_gadget *gadget) { }
 374
 375 /*----------------------------------------------------------------------*/
 376
 377 static struct miscdevice raw_misc_device;
 378
 379 static int raw_open(struct inode *inode, struct file *fd)
 380 {
 381         struct raw_dev *dev;
 382
 383         /* Nonblocking I/O is not supported yet. */
 384         if (fd->f_flags & O_NONBLOCK)
 385                 return -EINVAL;
 386
 387         dev = dev_new();
 388         if (!dev)
 389                 return -ENOMEM;
 390         fd->private_data = dev;
 391         dev->state = STATE_DEV_OPENED;
 392         dev->dev = raw_misc_device.this_device;
 393         return 0;
 394 }
 395
 396 static int raw_release(struct inode *inode, struct file *fd)
 397 {
 398         int ret = 0;
 399         struct raw_dev *dev = fd->private_data;
 400         unsigned long flags;
 401         bool unregister = false;
 402
 403         spin_lock_irqsave(&dev->lock, flags);
 404         dev->state = STATE_DEV_CLOSED;
 405         if (!dev->gadget) {
 406                 spin_unlock_irqrestore(&dev->lock, flags);
 407                 goto out_put;
 408         }
 409         if (dev->gadget_registered)
 410                 unregister = true;
 411         dev->gadget_registered = false;
 412         spin_unlock_irqrestore(&dev->lock, flags);
 413
 414         if (unregister) {
 415                 ret = usb_gadget_unregister_driver(&dev->driver);
 416                 if (ret != 0)
 417                         dev_err(dev->dev,
 418                                 "usb_gadget_unregister_driver() failed with %d\n",
 419                                 ret);
 420                 /* Matches kref_get() in raw_ioctl_run(). */
 421                 kref_put(&dev->count, dev_free);
 422         }
 423
 424 out_put:
 425         /* Matches dev_new() in raw_open(). */
 426         kref_put(&dev->count, dev_free);
 427         return ret;
 428 }
 429
 430 /*----------------------------------------------------------------------*/
 431
 432 static int raw_ioctl_init(struct raw_dev *dev, unsigned long value)
 433 {
 434         int ret = 0;
 435         int driver_id_number;
 436         struct usb_raw_init arg;
 437         char *udc_driver_name;
 438         char *udc_device_name;
 439         char *driver_driver_name;
 440         unsigned long flags;
 441
 442         if (copy_from_user(&arg, (void __user *)value, sizeof(arg)))
 443                 return -EFAULT;
 444
 445         switch (arg.speed) {
 446         case USB_SPEED_UNKNOWN:
 447                 arg.speed = USB_SPEED_HIGH;
 448                 break;
 449         case USB_SPEED_LOW:
 450         case USB_SPEED_FULL:
 451         case USB_SPEED_HIGH:
 452         case USB_SPEED_SUPER:
 453                 break;
 454         default:
 455                 return -EINVAL;
 456         }
 457
 458         driver_id_number = ida_alloc(&driver_id_numbers, GFP_KERNEL);
 459         if (driver_id_number < 0)
 460                 return driver_id_number;
 461
 462         driver_driver_name = kmalloc(DRIVER_DRIVER_NAME_LENGTH_MAX, GFP_KERNEL);
 463         if (!driver_driver_name) {
 464                 ret = -ENOMEM;
 465                 goto out_free_driver_id_number;
 466         }
 467         snprintf(driver_driver_name, DRIVER_DRIVER_NAME_LENGTH_MAX,
 468                                 DRIVER_NAME ".%d", driver_id_number);
 469
 470         udc_driver_name = kmalloc(UDC_NAME_LENGTH_MAX, GFP_KERNEL);
 471         if (!udc_driver_name) {
 472                 ret = -ENOMEM;
 473                 goto out_free_driver_driver_name;
 474         }
 475         ret = strscpy(udc_driver_name, &arg.driver_name[0],
 476                                 UDC_NAME_LENGTH_MAX);
 477         if (ret < 0)
 478                 goto out_free_udc_driver_name;
 479         ret = 0;
 480
 481         udc_device_name = kmalloc(UDC_NAME_LENGTH_MAX, GFP_KERNEL);
 482         if (!udc_device_name) {
 483                 ret = -ENOMEM;
 484                 goto out_free_udc_driver_name;
 485         }
 486         ret = strscpy(udc_device_name, &arg.device_name[0],
 487                                 UDC_NAME_LENGTH_MAX);
 488         if (ret < 0)
 489                 goto out_free_udc_device_name;
 490         ret = 0;
 491
 492         spin_lock_irqsave(&dev->lock, flags);
 493         if (dev->state != STATE_DEV_OPENED) {
 494                 dev_dbg(dev->dev, "fail, device is not opened\n");
 495                 ret = -EINVAL;
 496                 goto out_unlock;
 497         }
 498         dev->udc_name = udc_driver_name;
 499
 500         dev->driver.function = DRIVER_DESC;
 501         dev->driver.max_speed = arg.speed;
 502         dev->driver.setup = gadget_setup;
 503         dev->driver.disconnect = gadget_disconnect;
 504         dev->driver.bind = gadget_bind;
 505         dev->driver.unbind = gadget_unbind;
 506         dev->driver.suspend = gadget_suspend;
 507         dev->driver.resume = gadget_resume;
 508         dev->driver.reset = gadget_reset;
 509         dev->driver.driver.name = driver_driver_name;
 510         dev->driver.udc_name = udc_device_name;
 511         dev->driver.match_existing_only = 1;
 512         dev->driver_id_number = driver_id_number;
 513
 514         dev->state = STATE_DEV_INITIALIZED;
 515         spin_unlock_irqrestore(&dev->lock, flags);
 516         return ret;
 517
 518 out_unlock:
 519         spin_unlock_irqrestore(&dev->lock, flags);
 520 out_free_udc_device_name:
 521         kfree(udc_device_name);
 522 out_free_udc_driver_name:
 523         kfree(udc_driver_name);
 524 out_free_driver_driver_name:
 525         kfree(driver_driver_name);
 526 out_free_driver_id_number:
 527         ida_free(&driver_id_numbers, driver_id_number);
 528         return ret;
 529 }
 530
 531 static int raw_ioctl_run(struct raw_dev *dev, unsigned long value)
 532 {
 533         int ret = 0;
 534         unsigned long flags;
 535
 536         if (value)
 537                 return -EINVAL;
 538
 539         spin_lock_irqsave(&dev->lock, flags);
 540         if (dev->state != STATE_DEV_INITIALIZED) {
 541                 dev_dbg(dev->dev, "fail, device is not initialized\n");
 542                 ret = -EINVAL;
 543                 goto out_unlock;
 544         }
 545         dev->state = STATE_DEV_REGISTERING;
 546         spin_unlock_irqrestore(&dev->lock, flags);
 547
 548         ret = usb_gadget_register_driver(&dev->driver);
 549
 550         spin_lock_irqsave(&dev->lock, flags);
 551         if (ret) {
 552                 dev_err(dev->dev,
 553                         "fail, usb_gadget_register_driver returned %d\n", ret);
 554                 dev->state = STATE_DEV_FAILED;
 555                 goto out_unlock;
 556         }
 557         dev->gadget_registered = true;
 558         dev->state = STATE_DEV_RUNNING;
 559         /* Matches kref_put() in raw_release(). */
 560         kref_get(&dev->count);
 561
 562 out_unlock:
 563         spin_unlock_irqrestore(&dev->lock, flags);
 564         return ret;
 565 }
 566
 567 static int raw_ioctl_event_fetch(struct raw_dev *dev, unsigned long value)
 568 {
 569         struct usb_raw_event arg;
 570         unsigned long flags;
 571         struct usb_raw_event *event;
 572         uint32_t length;
 573
 574         if (copy_from_user(&arg, (void __user *)value, sizeof(arg)))
 575                 return -EFAULT;
 576
 577         spin_lock_irqsave(&dev->lock, flags);
 578         if (dev->state != STATE_DEV_RUNNING) {
 579                 dev_dbg(dev->dev, "fail, device is not running\n");
 580                 spin_unlock_irqrestore(&dev->lock, flags);
 581                 return -EINVAL;
 582         }
 583         if (!dev->gadget) {
 584                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 585                 spin_unlock_irqrestore(&dev->lock, flags);
 586                 return -EBUSY;
 587         }
 588         spin_unlock_irqrestore(&dev->lock, flags);
 589
 590         event = raw_event_queue_fetch(&dev->queue);
 591         if (PTR_ERR(event) == -EINTR) {
 592                 dev_dbg(&dev->gadget->dev, "event fetching interrupted\n");
 593                 return -EINTR;
 594         }
 595         if (IS_ERR(event)) {
 596                 dev_err(&dev->gadget->dev, "failed to fetch event\n");
 597                 spin_lock_irqsave(&dev->lock, flags);
 598                 dev->state = STATE_DEV_FAILED;
 599                 spin_unlock_irqrestore(&dev->lock, flags);
 600                 return -ENODEV;
 601         }
 602         length = min(arg.length, event->length);
 603         if (copy_to_user((void __user *)value, event, sizeof(*event) + length)) {
 604                 kfree(event);
 605                 return -EFAULT;
 606         }
 607
 608         kfree(event);
 609         return 0;
 610 }
 611
 612 static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr,
 613                                 bool get_from_user)
 614 {
 615         void *data;
 616
 617         if (copy_from_user(io, ptr, sizeof(*io)))
 618                 return ERR_PTR(-EFAULT);
 619         if (io->ep >= USB_RAW_EPS_NUM_MAX)
 620                 return ERR_PTR(-EINVAL);
 621         if (!usb_raw_io_flags_valid(io->flags))
 622                 return ERR_PTR(-EINVAL);
 623         if (io->length > PAGE_SIZE)
 624                 return ERR_PTR(-EINVAL);
 625         if (get_from_user)
 626                 data = memdup_user(ptr + sizeof(*io), io->length);
 627         else {
 628                 data = kmalloc(io->length, GFP_KERNEL);
 629                 if (!data)
 630                         data = ERR_PTR(-ENOMEM);
 631         }
 632         return data;
 633 }
 634
 635 static int raw_process_ep0_io(struct raw_dev *dev, struct usb_raw_ep_io *io,
 636                                 void *data, bool in)
 637 {
 638         int ret = 0;
 639         unsigned long flags;
 640
 641         spin_lock_irqsave(&dev->lock, flags);
 642         if (dev->state != STATE_DEV_RUNNING) {
 643                 dev_dbg(dev->dev, "fail, device is not running\n");
 644                 ret = -EINVAL;
 645                 goto out_unlock;
 646         }
 647         if (!dev->gadget) {
 648                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 649                 ret = -EBUSY;
 650                 goto out_unlock;
 651         }
 652         if (dev->ep0_urb_queued) {
 653                 dev_dbg(&dev->gadget->dev, "fail, urb already queued\n");
 654                 ret = -EBUSY;
 655                 goto out_unlock;
 656         }
 657         if ((in && !dev->ep0_in_pending) ||
 658                         (!in && !dev->ep0_out_pending)) {
 659                 dev_dbg(&dev->gadget->dev, "fail, wrong direction\n");
 660                 ret = -EBUSY;
 661                 goto out_unlock;
 662         }
 663         if (WARN_ON(in && dev->ep0_out_pending)) {
 664                 ret = -ENODEV;
 665                 dev->state = STATE_DEV_FAILED;
 666                 goto out_done;
 667         }
 668         if (WARN_ON(!in && dev->ep0_in_pending)) {
 669                 ret = -ENODEV;
 670                 dev->state = STATE_DEV_FAILED;
 671                 goto out_done;
 672         }
 673
 674         dev->req->buf = data;
 675         dev->req->length = io->length;
 676         dev->req->zero = usb_raw_io_flags_zero(io->flags);
 677         dev->ep0_urb_queued = true;
 678         spin_unlock_irqrestore(&dev->lock, flags);
 679
 680         ret = usb_ep_queue(dev->gadget->ep0, dev->req, GFP_KERNEL);
 681         if (ret) {
 682                 dev_err(&dev->gadget->dev,
 683                                 "fail, usb_ep_queue returned %d\n", ret);
 684                 spin_lock_irqsave(&dev->lock, flags);
 685                 dev->state = STATE_DEV_FAILED;
 686                 goto out_done;
 687         }
 688
 689         ret = wait_for_completion_interruptible(&dev->ep0_done);
 690         if (ret) {
 691                 dev_dbg(&dev->gadget->dev, "wait interrupted\n");
 692                 usb_ep_dequeue(dev->gadget->ep0, dev->req);
 693                 wait_for_completion(&dev->ep0_done);
 694                 spin_lock_irqsave(&dev->lock, flags);
 695                 goto out_done;
 696         }
 697
 698         spin_lock_irqsave(&dev->lock, flags);
 699         ret = dev->ep0_status;
 700
 701 out_done:
 702         dev->ep0_urb_queued = false;
 703 out_unlock:
 704         spin_unlock_irqrestore(&dev->lock, flags);
 705         return ret;
 706 }
 707
 708 static int raw_ioctl_ep0_write(struct raw_dev *dev, unsigned long value)
 709 {
 710         int ret = 0;
 711         void *data;
 712         struct usb_raw_ep_io io;
 713
 714         data = raw_alloc_io_data(&io, (void __user *)value, true);
 715         if (IS_ERR(data))
 716                 return PTR_ERR(data);
 717         ret = raw_process_ep0_io(dev, &io, data, true);
 718         kfree(data);
 719         return ret;
 720 }
 721
 722 static int raw_ioctl_ep0_read(struct raw_dev *dev, unsigned long value)
 723 {
 724         int ret = 0;
 725         void *data;
 726         struct usb_raw_ep_io io;
 727         unsigned int length;
 728
 729         data = raw_alloc_io_data(&io, (void __user *)value, false);
 730         if (IS_ERR(data))
 731                 return PTR_ERR(data);
 732         ret = raw_process_ep0_io(dev, &io, data, false);
 733         if (ret < 0)
 734                 goto free;
 735
 736         length = min(io.length, (unsigned int)ret);
 737         if (copy_to_user((void __user *)(value + sizeof(io)), data, length))
 738                 ret = -EFAULT;
 739         else
 740                 ret = length;
 741 free:
 742         kfree(data);
 743         return ret;
 744 }
 745
 746 static int raw_ioctl_ep0_stall(struct raw_dev *dev, unsigned long value)
 747 {
 748         int ret = 0;
 749         unsigned long flags;
 750
 751         if (value)
 752                 return -EINVAL;
 753         spin_lock_irqsave(&dev->lock, flags);
 754         if (dev->state != STATE_DEV_RUNNING) {
 755                 dev_dbg(dev->dev, "fail, device is not running\n");
 756                 ret = -EINVAL;
 757                 goto out_unlock;
 758         }
 759         if (!dev->gadget) {
 760                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 761                 ret = -EBUSY;
 762                 goto out_unlock;
 763         }
 764         if (dev->ep0_urb_queued) {
 765                 dev_dbg(&dev->gadget->dev, "fail, urb already queued\n");
 766                 ret = -EBUSY;
 767                 goto out_unlock;
 768         }
 769         if (!dev->ep0_in_pending && !dev->ep0_out_pending) {
 770                 dev_dbg(&dev->gadget->dev, "fail, no request pending\n");
 771                 ret = -EBUSY;
 772                 goto out_unlock;
 773         }
 774
 775         ret = usb_ep_set_halt(dev->gadget->ep0);
 776         if (ret < 0)
 777                 dev_err(&dev->gadget->dev,
 778                                 "fail, usb_ep_set_halt returned %d\n", ret);
 779
 780         if (dev->ep0_in_pending)
 781                 dev->ep0_in_pending = false;
 782         else
 783                 dev->ep0_out_pending = false;
 784
 785 out_unlock:
 786         spin_unlock_irqrestore(&dev->lock, flags);
 787         return ret;
 788 }
 789
 790 static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value)
 791 {
 792         int ret = 0, i;
 793         unsigned long flags;
 794         struct usb_endpoint_descriptor *desc;
 795         struct raw_ep *ep;
 796         bool ep_props_matched = false;
 797
 798         desc = memdup_user((void __user *)value, sizeof(*desc));
 799         if (IS_ERR(desc))
 800                 return PTR_ERR(desc);
 801
 802         /*
 803          * Endpoints with a maxpacket length of 0 can cause crashes in UDC
 804          * drivers.
 805          */
 806         if (usb_endpoint_maxp(desc) == 0) {
 807                 dev_dbg(dev->dev, "fail, bad endpoint maxpacket\n");
 808                 kfree(desc);
 809                 return -EINVAL;
 810         }
 811
 812         spin_lock_irqsave(&dev->lock, flags);
 813         if (dev->state != STATE_DEV_RUNNING) {
 814                 dev_dbg(dev->dev, "fail, device is not running\n");
 815                 ret = -EINVAL;
 816                 goto out_free;
 817         }
 818         if (!dev->gadget) {
 819                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 820                 ret = -EBUSY;
 821                 goto out_free;
 822         }
 823
 824         for (i = 0; i < dev->eps_num; i++) {
 825                 ep = &dev->eps[i];
 826                 if (ep->addr != usb_endpoint_num(desc) &&
 827                                 ep->addr != USB_RAW_EP_ADDR_ANY)
 828                         continue;
 829                 if (!usb_gadget_ep_match_desc(dev->gadget, ep->ep, desc, NULL))
 830                         continue;
 831                 ep_props_matched = true;
 832                 if (ep->state != STATE_EP_DISABLED)
 833                         continue;
 834                 ep->ep->desc = desc;
 835                 ret = usb_ep_enable(ep->ep);
 836                 if (ret < 0) {
 837                         dev_err(&dev->gadget->dev,
 838                                 "fail, usb_ep_enable returned %d\n", ret);
 839                         goto out_free;
 840                 }
 841                 ep->req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC);
 842                 if (!ep->req) {
 843                         dev_err(&dev->gadget->dev,
 844                                 "fail, usb_ep_alloc_request failed\n");
 845                         usb_ep_disable(ep->ep);
 846                         ret = -ENOMEM;
 847                         goto out_free;
 848                 }
 849                 ep->state = STATE_EP_ENABLED;
 850                 ep->ep->driver_data = ep;
 851                 ret = i;
 852                 goto out_unlock;
 853         }
 854
 855         if (!ep_props_matched) {
 856                 dev_dbg(&dev->gadget->dev, "fail, bad endpoint descriptor\n");
 857                 ret = -EINVAL;
 858         } else {
 859                 dev_dbg(&dev->gadget->dev, "fail, no endpoints available\n");
 860                 ret = -EBUSY;
 861         }
 862
 863 out_free:
 864         kfree(desc);
 865 out_unlock:
 866         spin_unlock_irqrestore(&dev->lock, flags);
 867         return ret;
 868 }
 869
 870 static int raw_ioctl_ep_disable(struct raw_dev *dev, unsigned long value)
 871 {
 872         int ret = 0, i = value;
 873         unsigned long flags;
 874
 875         spin_lock_irqsave(&dev->lock, flags);
 876         if (dev->state != STATE_DEV_RUNNING) {
 877                 dev_dbg(dev->dev, "fail, device is not running\n");
 878                 ret = -EINVAL;
 879                 goto out_unlock;
 880         }
 881         if (!dev->gadget) {
 882                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 883                 ret = -EBUSY;
 884                 goto out_unlock;
 885         }
 886         if (i < 0 || i >= dev->eps_num) {
 887                 dev_dbg(dev->dev, "fail, invalid endpoint\n");
 888                 ret = -EBUSY;
 889                 goto out_unlock;
 890         }
 891         if (dev->eps[i].state == STATE_EP_DISABLED) {
 892                 dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n");
 893                 ret = -EINVAL;
 894                 goto out_unlock;
 895         }
 896         if (dev->eps[i].disabling) {
 897                 dev_dbg(&dev->gadget->dev,
 898                                 "fail, disable already in progress\n");
 899                 ret = -EINVAL;
 900                 goto out_unlock;
 901         }
 902         if (dev->eps[i].urb_queued) {
 903                 dev_dbg(&dev->gadget->dev,
 904                                 "fail, waiting for urb completion\n");
 905                 ret = -EINVAL;
 906                 goto out_unlock;
 907         }
 908         dev->eps[i].disabling = true;
 909         spin_unlock_irqrestore(&dev->lock, flags);
 910
 911         usb_ep_disable(dev->eps[i].ep);
 912
 913         spin_lock_irqsave(&dev->lock, flags);
 914         usb_ep_free_request(dev->eps[i].ep, dev->eps[i].req);
 915         kfree(dev->eps[i].ep->desc);
 916         dev->eps[i].state = STATE_EP_DISABLED;
 917         dev->eps[i].disabling = false;
 918
 919 out_unlock:
 920         spin_unlock_irqrestore(&dev->lock, flags);
 921         return ret;
 922 }
 923
 924 static int raw_ioctl_ep_set_clear_halt_wedge(struct raw_dev *dev,
 925                 unsigned long value, bool set, bool halt)
 926 {
 927         int ret = 0, i = value;
 928         unsigned long flags;
 929
 930         spin_lock_irqsave(&dev->lock, flags);
 931         if (dev->state != STATE_DEV_RUNNING) {
 932                 dev_dbg(dev->dev, "fail, device is not running\n");
 933                 ret = -EINVAL;
 934                 goto out_unlock;
 935         }
 936         if (!dev->gadget) {
 937                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 938                 ret = -EBUSY;
 939                 goto out_unlock;
 940         }
 941         if (i < 0 || i >= dev->eps_num) {
 942                 dev_dbg(dev->dev, "fail, invalid endpoint\n");
 943                 ret = -EBUSY;
 944                 goto out_unlock;
 945         }
 946         if (dev->eps[i].state == STATE_EP_DISABLED) {
 947                 dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n");
 948                 ret = -EINVAL;
 949                 goto out_unlock;
 950         }
 951         if (dev->eps[i].disabling) {
 952                 dev_dbg(&dev->gadget->dev,
 953                                 "fail, disable is in progress\n");
 954                 ret = -EINVAL;
 955                 goto out_unlock;
 956         }
 957         if (dev->eps[i].urb_queued) {
 958                 dev_dbg(&dev->gadget->dev,
 959                                 "fail, waiting for urb completion\n");
 960                 ret = -EINVAL;
 961                 goto out_unlock;
 962         }
 963         if (usb_endpoint_xfer_isoc(dev->eps[i].ep->desc)) {
 964                 dev_dbg(&dev->gadget->dev,
 965                                 "fail, can't halt/wedge ISO endpoint\n");
 966                 ret = -EINVAL;
 967                 goto out_unlock;
 968         }
 969
 970         if (set && halt) {
 971                 ret = usb_ep_set_halt(dev->eps[i].ep);
 972                 if (ret < 0)
 973                         dev_err(&dev->gadget->dev,
 974                                 "fail, usb_ep_set_halt returned %d\n", ret);
 975         } else if (!set && halt) {
 976                 ret = usb_ep_clear_halt(dev->eps[i].ep);
 977                 if (ret < 0)
 978                         dev_err(&dev->gadget->dev,
 979                                 "fail, usb_ep_clear_halt returned %d\n", ret);
 980         } else if (set && !halt) {
 981                 ret = usb_ep_set_wedge(dev->eps[i].ep);
 982                 if (ret < 0)
 983                         dev_err(&dev->gadget->dev,
 984                                 "fail, usb_ep_set_wedge returned %d\n", ret);
 985         }
 986
 987 out_unlock:
 988         spin_unlock_irqrestore(&dev->lock, flags);
 989         return ret;
 990 }
 991
 992 static void gadget_ep_complete(struct usb_ep *ep, struct usb_request *req)
 993 {
 994         struct raw_ep *r_ep = (struct raw_ep *)ep->driver_data;
 995         struct raw_dev *dev = r_ep->dev;
 996         unsigned long flags;
 997
 998         spin_lock_irqsave(&dev->lock, flags);
 999         if (req->status)
1000                 r_ep->status = req->status;
1001         else
1002                 r_ep->status = req->actual;
1003         spin_unlock_irqrestore(&dev->lock, flags);
1004
1005         complete((struct completion *)req->context);
1006 }
1007
1008 static int raw_process_ep_io(struct raw_dev *dev, struct usb_raw_ep_io *io,
1009                                 void *data, bool in)
1010 {
1011         int ret = 0;
1012         unsigned long flags;
1013         struct raw_ep *ep;
1014         DECLARE_COMPLETION_ONSTACK(done);
1015
1016         spin_lock_irqsave(&dev->lock, flags);
1017         if (dev->state != STATE_DEV_RUNNING) {
1018                 dev_dbg(dev->dev, "fail, device is not running\n");
1019                 ret = -EINVAL;
1020                 goto out_unlock;
1021         }
1022         if (!dev->gadget) {
1023                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
1024                 ret = -EBUSY;
1025                 goto out_unlock;
1026         }
1027         if (io->ep >= dev->eps_num) {
1028                 dev_dbg(&dev->gadget->dev, "fail, invalid endpoint\n");
1029                 ret = -EINVAL;
1030                 goto out_unlock;
1031         }
1032         ep = &dev->eps[io->ep];
1033         if (ep->state != STATE_EP_ENABLED) {
1034                 dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n");
1035                 ret = -EBUSY;
1036                 goto out_unlock;
1037         }
1038         if (ep->disabling) {
1039                 dev_dbg(&dev->gadget->dev,
1040                                 "fail, endpoint is already being disabled\n");
1041                 ret = -EBUSY;
1042                 goto out_unlock;
1043         }
1044         if (ep->urb_queued) {
1045                 dev_dbg(&dev->gadget->dev, "fail, urb already queued\n");
1046                 ret = -EBUSY;
1047                 goto out_unlock;
1048         }
1049         if (in != usb_endpoint_dir_in(ep->ep->desc)) {
1050                 dev_dbg(&dev->gadget->dev, "fail, wrong direction\n");
1051                 ret = -EINVAL;
1052                 goto out_unlock;
1053         }
1054
1055         ep->dev = dev;
1056         ep->req->context = &done;
1057         ep->req->complete = gadget_ep_complete;
1058         ep->req->buf = data;
1059         ep->req->length = io->length;
1060         ep->req->zero = usb_raw_io_flags_zero(io->flags);
1061         ep->urb_queued = true;
1062         spin_unlock_irqrestore(&dev->lock, flags);
1063
1064         ret = usb_ep_queue(ep->ep, ep->req, GFP_KERNEL);
1065         if (ret) {
1066                 dev_err(&dev->gadget->dev,
1067                                 "fail, usb_ep_queue returned %d\n", ret);
1068                 spin_lock_irqsave(&dev->lock, flags);
1069                 dev->state = STATE_DEV_FAILED;
1070                 goto out_done;
1071         }
1072
1073         ret = wait_for_completion_interruptible(&done);
1074         if (ret) {
1075                 dev_dbg(&dev->gadget->dev, "wait interrupted\n");
1076                 usb_ep_dequeue(ep->ep, ep->req);
1077                 wait_for_completion(&done);
1078                 spin_lock_irqsave(&dev->lock, flags);
1079                 goto out_done;
1080         }
1081
1082         spin_lock_irqsave(&dev->lock, flags);
1083         ret = ep->status;
1084
1085 out_done:
1086         ep->urb_queued = false;
1087 out_unlock:
1088         spin_unlock_irqrestore(&dev->lock, flags);
1089         return ret;
1090 }
1091
1092 static int raw_ioctl_ep_write(struct raw_dev *dev, unsigned long value)
1093 {
1094         int ret = 0;
1095         char *data;
1096         struct usb_raw_ep_io io;
1097
1098         data = raw_alloc_io_data(&io, (void __user *)value, true);
1099         if (IS_ERR(data))
1100                 return PTR_ERR(data);
1101         ret = raw_process_ep_io(dev, &io, data, true);
1102         kfree(data);
1103         return ret;
1104 }
1105
1106 static int raw_ioctl_ep_read(struct raw_dev *dev, unsigned long value)
1107 {
1108         int ret = 0;
1109         char *data;
1110         struct usb_raw_ep_io io;
1111         unsigned int length;
1112
1113         data = raw_alloc_io_data(&io, (void __user *)value, false);
1114         if (IS_ERR(data))
1115                 return PTR_ERR(data);
1116         ret = raw_process_ep_io(dev, &io, data, false);
1117         if (ret < 0)
1118                 goto free;
1119
1120         length = min(io.length, (unsigned int)ret);
1121         if (copy_to_user((void __user *)(value + sizeof(io)), data, length))
1122                 ret = -EFAULT;
1123         else
1124                 ret = length;
1125 free:
1126         kfree(data);
1127         return ret;
1128 }
1129
1130 static int raw_ioctl_configure(struct raw_dev *dev, unsigned long value)
1131 {
1132         int ret = 0;
1133         unsigned long flags;
1134
1135         if (value)
1136                 return -EINVAL;
1137         spin_lock_irqsave(&dev->lock, flags);
1138         if (dev->state != STATE_DEV_RUNNING) {
1139                 dev_dbg(dev->dev, "fail, device is not running\n");
1140                 ret = -EINVAL;
1141                 goto out_unlock;
1142         }
1143         if (!dev->gadget) {
1144                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
1145                 ret = -EBUSY;
1146                 goto out_unlock;
1147         }
1148         usb_gadget_set_state(dev->gadget, USB_STATE_CONFIGURED);
1149
1150 out_unlock:
1151         spin_unlock_irqrestore(&dev->lock, flags);
1152         return ret;
1153 }
1154
1155 static int raw_ioctl_vbus_draw(struct raw_dev *dev, unsigned long value)
1156 {
1157         int ret = 0;
1158         unsigned long flags;
1159
1160         spin_lock_irqsave(&dev->lock, flags);
1161         if (dev->state != STATE_DEV_RUNNING) {
1162                 dev_dbg(dev->dev, "fail, device is not running\n");
1163                 ret = -EINVAL;
1164                 goto out_unlock;
1165         }
1166         if (!dev->gadget) {
1167                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
1168                 ret = -EBUSY;
1169                 goto out_unlock;
1170         }
1171         usb_gadget_vbus_draw(dev->gadget, 2 * value);
1172
1173 out_unlock:
1174         spin_unlock_irqrestore(&dev->lock, flags);
1175         return ret;
1176 }
1177
1178 static void fill_ep_caps(struct usb_ep_caps *caps,
1179                                 struct usb_raw_ep_caps *raw_caps)
1180 {
1181         raw_caps->type_control = caps->type_control;
1182         raw_caps->type_iso = caps->type_iso;
1183         raw_caps->type_bulk = caps->type_bulk;
1184         raw_caps->type_int = caps->type_int;
1185         raw_caps->dir_in = caps->dir_in;
1186         raw_caps->dir_out = caps->dir_out;
1187 }
1188
1189 static void fill_ep_limits(struct usb_ep *ep, struct usb_raw_ep_limits *limits)
1190 {
1191         limits->maxpacket_limit = ep->maxpacket_limit;
1192         limits->max_streams = ep->max_streams;
1193 }
1194
1195 static int raw_ioctl_eps_info(struct raw_dev *dev, unsigned long value)
1196 {
1197         int ret = 0, i;
1198         unsigned long flags;
1199         struct usb_raw_eps_info *info;
1200         struct raw_ep *ep;
1201
1202         info = kzalloc(sizeof(*info), GFP_KERNEL);
1203         if (!info) {
1204                 ret = -ENOMEM;
1205                 goto out;
1206         }
1207
1208         spin_lock_irqsave(&dev->lock, flags);
1209         if (dev->state != STATE_DEV_RUNNING) {
1210                 dev_dbg(dev->dev, "fail, device is not running\n");
1211                 ret = -EINVAL;
1212                 spin_unlock_irqrestore(&dev->lock, flags);
1213                 goto out_free;
1214         }
1215         if (!dev->gadget) {
1216                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
1217                 ret = -EBUSY;
1218                 spin_unlock_irqrestore(&dev->lock, flags);
1219                 goto out_free;
1220         }
1221
1222         for (i = 0; i < dev->eps_num; i++) {
1223                 ep = &dev->eps[i];
1224                 strscpy(&info->eps[i].name[0], ep->ep->name,
1225                                 USB_RAW_EP_NAME_MAX);
1226                 info->eps[i].addr = ep->addr;
1227                 fill_ep_caps(&ep->ep->caps, &info->eps[i].caps);
1228                 fill_ep_limits(ep->ep, &info->eps[i].limits);
1229         }
1230         ret = dev->eps_num;
1231         spin_unlock_irqrestore(&dev->lock, flags);
1232
1233         if (copy_to_user((void __user *)value, info, sizeof(*info)))
1234                 ret = -EFAULT;
1235
1236 out_free:
1237         kfree(info);
1238 out:
1239         return ret;
1240 }
1241
1242 static long raw_ioctl(struct file *fd, unsigned int cmd, unsigned long value)
1243 {
1244         struct raw_dev *dev = fd->private_data;
1245         int ret = 0;
1246
1247         if (!dev)
1248                 return -EBUSY;
1249
1250         switch (cmd) {
1251         case USB_RAW_IOCTL_INIT:
1252                 ret = raw_ioctl_init(dev, value);
1253                 break;
1254         case USB_RAW_IOCTL_RUN:
1255                 ret = raw_ioctl_run(dev, value);
1256                 break;
1257         case USB_RAW_IOCTL_EVENT_FETCH:
1258                 ret = raw_ioctl_event_fetch(dev, value);
1259                 break;
1260         case USB_RAW_IOCTL_EP0_WRITE:
1261                 ret = raw_ioctl_ep0_write(dev, value);
1262                 break;
1263         case USB_RAW_IOCTL_EP0_READ:
1264                 ret = raw_ioctl_ep0_read(dev, value);
1265                 break;
1266         case USB_RAW_IOCTL_EP_ENABLE:
1267                 ret = raw_ioctl_ep_enable(dev, value);
1268                 break;
1269         case USB_RAW_IOCTL_EP_DISABLE:
1270                 ret = raw_ioctl_ep_disable(dev, value);
1271                 break;
1272         case USB_RAW_IOCTL_EP_WRITE:
1273                 ret = raw_ioctl_ep_write(dev, value);
1274                 break;
1275         case USB_RAW_IOCTL_EP_READ:
1276                 ret = raw_ioctl_ep_read(dev, value);
1277                 break;
1278         case USB_RAW_IOCTL_CONFIGURE:
1279                 ret = raw_ioctl_configure(dev, value);
1280                 break;
1281         case USB_RAW_IOCTL_VBUS_DRAW:
1282                 ret = raw_ioctl_vbus_draw(dev, value);
1283                 break;
1284         case USB_RAW_IOCTL_EPS_INFO:
1285                 ret = raw_ioctl_eps_info(dev, value);
1286                 break;
1287         case USB_RAW_IOCTL_EP0_STALL:
1288                 ret = raw_ioctl_ep0_stall(dev, value);
1289                 break;
1290         case USB_RAW_IOCTL_EP_SET_HALT:
1291                 ret = raw_ioctl_ep_set_clear_halt_wedge(
1292                                         dev, value, true, true);
1293                 break;
1294         case USB_RAW_IOCTL_EP_CLEAR_HALT:
1295                 ret = raw_ioctl_ep_set_clear_halt_wedge(
1296                                         dev, value, false, true);
1297                 break;
1298         case USB_RAW_IOCTL_EP_SET_WEDGE:
1299                 ret = raw_ioctl_ep_set_clear_halt_wedge(
1300                                         dev, value, true, false);
1301                 break;
1302         default:
1303                 ret = -EINVAL;
1304         }
1305
1306         return ret;
1307 }
1308
1309 /*----------------------------------------------------------------------*/
1310
1311 static const struct file_operations raw_fops = {
1312         .open =                 raw_open,
1313         .unlocked_ioctl =       raw_ioctl,
1314         .compat_ioctl =         raw_ioctl,
1315         .release =              raw_release,
1316         .llseek =               no_llseek,
1317 };
1318
1319 static struct miscdevice raw_misc_device = {
1320         .minor = MISC_DYNAMIC_MINOR,
1321         .name = DRIVER_NAME,
1322         .fops = &raw_fops,
1323 };
1324
1325 module_misc_device(raw_misc_device);